Wi-Fi Assistant opt-out for network administrators

If you're a network administrator, you can prevent Wi-Fi Assistant users from making use of your network. You can do this by blocking a canary URL, securing your network, or modifying your SSID.

Opt out by blocking a canary URL

To opt out, you can block access to a canary URL (https://check.g-tun.com/connect) and return a response other than a status code 200 with a response body of "OK.” This URL is only used for this purpose and doesn't serve any other content. You should send an immediate response for the canary URL rather than inducing a DNS or connection timeout, which will delay opt-out detection.

When Wi-Fi Assistant connects to a network, the client synchronously issues an in-the-clear HTTP request to the canary URL prior to establishing a VPN connection.

There are two possible outcomes of the canary URL request:

If the response status code is 200 and the response body is "OK," Wi-Fi Assistant establishes a VPN connection and enables use of the network.

If the response status code is anything other than 200 or the response body is anything other than "OK", Wi-Fi Assistant disconnects from the network.

Opt out by securing your network

If your network is open, you can prevent Wi-Fi Assistant from connecting users to your network by securing your network using any common security protocol, including WEP, WPA, or WPA2. Consult your wireless access point manufacturer for instructions.